
    Yj-S                       d dl mZ d dlZd dlZd dlZd dlZd dlmZm	Z	m
Z
 d dlmZmZ d dlZd dlZddlmZ ddlmZmZmZ dd	lmZmZmZmZ dd
lmZmZmZ ddlm Z m!Z!m"Z"m#Z# dZ$dZ%dZ&dZ'dZ(dZ)h dZ* ejV                  d      Z,ddd/dZ-d0dZ.d0dZ/	 	 	 	 	 	 	 	 	 	 d1dZ0 G d dejb                        Z2 G d dejf                        Z4ddd	 	 	 	 	 	 	 	 	 d2dZ5ddd	 	 	 	 	 	 	 	 	 d3dZ6d4d Z7	 	 	 	 d5d!Z8d6d"Z9d7d#Z:	 	 	 	 	 	 d8d$Z;d9d%Z<d:d&Z=d;d'Z>d<d(Z? G d) d*ee         Z@ G d+ d,e@      ZA G d- d.e@      ZBy)=    )annotationsN)AnyNoReturncast)TypeIsoverride   )is_dict)timeout_exceptionsnormalize_httpx_url_loaded_legacy_httpx   )TOKEN_EXCHANGE_GRANT_TYPEWorkloadIdentityX509WorkloadIdentity_WorkloadIdentityAuth)MAX_RETRY_DELAYINITIAL_RETRY_DELAYMAX_RETRY_AFTER_DELAY)
OAuthErrorOpenAIErrorAPITimeoutErrorAPIConnectionErrorzhttps://mtls.api.openai.com/v1z(https://mtls.auth.openai.com/oauth/tokenz'urn:openai:params:oauth:token-type:x509openai_x509_replay_position!openai_x509_replay_file_positions>   typeservice_account_ididentity_provider_idrefresh_buffer_secondsz[A-Za-z0-9._~+/-]+=*expected_originc               *   t        |       }|j                  dk7  s|j                  st        d      |j                  s|j
                  rt        d      |=|j                  |j                  f|j                  |j                  fk7  rt        d      y y )Nhttpsz:X.509 workload identity requires an absolute HTTPS API URLz@X.509 workload identity API URLs cannot contain user credentialszCX.509 workload identity requests must use the configured API origin)r   schemehostr   usernamepasswordport)urlr!   normalized_urls      P/var/www/html/vmm-quimica/venv/lib/python3.12/site-packages/openai/auth/_x509.pyvalidate_x509_api_urlr,   "   s    (-N'~/B/BVWW."9"9\]]"(;(;^=P=P'QV ( _``	("    c                R    t        d | j                  D              rt        d      y )Nc              3  `   K   | ]&  }|j                         j                  d d      dv  ( yw)_-)api-key	x-api-keyproxy-authorizationNlowerreplace.0headers     r+   	<genexpr>z0validate_x509_api_credentials.<locals>.<genexpr>2   s1       	sC(,[[   ,.zLX.509 workload identity requests cannot include API-key or proxy credentials)anyheadersr   requests    r+   validate_x509_api_credentialsrA   1   s.    
 oo  hii	r-   c                r   | j                   j                  d      t              dk7  s0t        fddD              st        d | j                   D              rt	        d      	 t        j                  dd          }|j                  sx|j                  sl|j                  d
k7  s]|j                  sQ|j                  sE|j                  |j                  f| j                  j                  | j                  j                  fk7  rt	        d      y # t
        j                  $ r}t	        d	      |d }~ww xY w)Nr%   r   c              3  ,   K   | ]  }|d    v   yw)r   N )r9   	delimiterhost_headerss     r+   r;   z2validate_x509_request_authority.<locals>.<genexpr>=   s     F	yLO+Fs   z/?#@\c              3  >   K   | ]  }|j                  d         yw):N)
startswithr8   s     r+   r;   z2validate_x509_request_authority.<locals>.<genexpr>>   s     D&v  %Ds   zIX.509 workload identity requests require exactly one valid Host authorityzhttps://r   z?X.509 workload identity requests require a valid Host authority/zAX.509 workload identity Host authority must match the request URL)r>   get_listlenr=   r   httpx2URL
InvalidURLr&   r'   pathqueryfragmentr%   r(   r)   )r@   host_urlerrorrF   s      @r+   validate_x509_request_authorityrU   9   s	   ??++F3LLQFXFFDGOODDeffh::a(9:;
 	==C>>MM8==)gkk.>.>@P@P-QQ]^^ R  h[\bgghs   'D D6%D11D6c               R   t        | j                  |       t        |        |rOt        | j                        t        k7  rt        d      t        d | j                  D              rt        d      y t        |        | j                  j                  d      |k7  rt        d      y )Nr    zDX.509 token exchange requests must use the pinned authentication URLc              3  `   K   | ]&  }|j                         j                  d d      dv  ( yw)r0   r1   )authorizationr4   cookier3   r2   Nr5   r8   s     r+   r;   z._validate_transport_request.<locals>.<genexpr>_   s6      
  LLN""3,YZ
r<   z<X.509 token exchange requests cannot include API credentialsAuthorizationzMX.509 workload identity authorization cannot be changed by HTTP request hooks)
r,   r)   rU   str_X509_TOKEN_EXCHANGE_URLr   r=   r>   rA   get)r@   r!   expected_authorizationtoken_exchanges       r+   _validate_transport_requestr`   R   s     '++G#G,w{{77dee 
 "//
 

 \]]
 	&g.??/3IImnn Jr-   c                  L    e Zd Z	 	 	 	 	 	 	 	 	 	 ddZedd       Zedd       Zy)_SyncX509ForwardingTransportc               <    || _         || _        || _        || _        y N_http_client_expected_origin_expected_authorization_token_exchangeselfhttp_clientr!   r^   r_   s        r+   __init__z%_SyncX509ForwardingTransport.__init__l   $     ( /'=$-r-   c                   t        || j                  | j                  | j                         | j                  j
                  rt        d      | j                  j                  |j                        j                  |      S N)r!   r^   r_   z5Cannot send a request, as the client has been closed.)
r`   rg   rh   ri   rf   	is_closedRuntimeError_transport_for_urlr)   handle_requestrk   r@   s     r+   rt   z+_SyncX509ForwardingTransport.handle_requesty   sl    # 11#'#?#?//		
 &&VWW  33GKK@OOPWXXr-   c                     y rd   rD   rk   s    r+   closez"_SyncX509ForwardingTransport.close   s     r-   N)
rl   httpx2.Clientr!   
httpx2.URLr^   
str | Noner_   boolreturnNoner@   httpx2.Requestr}   httpx2.Responser}   r~   )__name__
__module____qualname__rm   r   rt   rx   rD   r-   r+   rb   rb   k   sc    . #. $	.
 !+. . 
. 	Y 	Y  r-   rb   c                  L    e Zd Z	 	 	 	 	 	 	 	 	 	 ddZedd       Zedd       Zy)_AsyncX509ForwardingTransportc               <    || _         || _        || _        || _        y rd   re   rj   s        r+   rm   z&_AsyncX509ForwardingTransport.__init__   rn   r-   c                "  K   t        || j                  | j                  | j                         | j                  j
                  rt        d      | j                  j                  |j                        j                  |       d {   S 7 wrp   )
r`   rg   rh   ri   rf   rq   rr   rs   r)   handle_async_requestru   s     r+   r   z2_AsyncX509ForwardingTransport.handle_async_request   sv     # 11#'#?#?//		
 &&VWW&&99'++F[[\cdddds   BBB	Bc                   K   y wrd   rD   rw   s    r+   aclosez$_AsyncX509ForwardingTransport.aclose   s      s   N)
rl   httpx2.AsyncClientr!   rz   r^   r{   r_   r|   r}   r~   r   r   )r   r   r   rm   r   r   r   rD   r-   r+   r   r      sc    . (. $	.
 !+. . 
. 	e 	e  r-   r   F)r^   r_   c               2   t        | |||      }t               }t        j                  }|4t	        t        t        |       t        j                        s|j                  } ||| j                  |rd n| j                  d      }|s| j                  |_
        |S N)rl   r!   r^   r_   F)	transporttimeoutevent_hooks	trust_env)rb   r   rM   Client
isinstancer   objectr   r   cookies_cookiesrl   r!   r^   r_   r   legacy_httpxclient_typescoped_clients           r+   _scoped_sync_clientr      s     -'5%	I ()L--K
43Lfmm(\"))##*D0G0G	M !,!4!4r-   c               2   t        | |||      }t               }t        j                  }|4t	        t        t        |       t        j                        s|j                  } ||| j                  |rd n| j                  d      }|s| j                  |_
        |S r   )r   r   rM   AsyncClientr   r   r   r   r   r   r   r   s           r+   _scoped_async_clientr      s     .'5%	I ()L$$K
43LfN`N`(a"..##*D0G0G	M !,!4!4r-   c                    t        | t              st        | t        t        f      sy 	 t        |       } t        j                  |       r| S d S # t        $ r Y y w xY wrd   )r   r|   intfloatOverflowErrormathisfinite)values    r+   _as_finite_floatr      sV    %je&Ee MM%(52d2  s   A 	AAc                6    | d uxr | j                  d      dk(  S )Nr   x509)r]   identitys    r+   is_x509_workload_identityr      s"     4BHLL$8F$BBr-   c                <   d| v sd| v rt        d      t        |       t        z
  rt        d      | j                  d      r| j                  d      st        d      t	        t
        | j                  d            }|t        |      }||d	k  rt        d
      y y )Nprovider	client_idzMX.509 workload identity does not accept a subject-token provider or client IDzPX.509 workload identity accepts only identity IDs and an optional refresh bufferr   r   zJX.509 workload identity requires identity-provider and service-account IDsr   r   zFX.509 workload identity requires a finite, non-negative refresh buffer)r   set_ALLOWED_IDENTITY_FIELDSr]   r   r   r   )r   refresh_bufferrefresh_buffer_values      r+   _validate_identityr      s    X!8ijj
8}//lmm<<./x||DX7Yfgg&(,,/G"HIN!/?'+?!+Cfgg ,D "r-   c                ,    t         t        | d   | d   dS )Nr   r   )
grant_typesubject_token_typer   r   )r   _X509_SUBJECT_TOKEN_TYPEr   s    r+   _exchange_payloadr     s$    /6 ()? @&';<	 r-   c          	        t         j                  }t               }|qt        t	        t
        |      t         j                  t         j                  f      s9t	        t        t         j                     t	        t        |      j                        } |dt        t        |       dt        j                  d      j                         i      S )NPOSTr   g      $@)json
extensions)rM   Requestr   r   r   r   r   r   r   r   r\   r   Timeoutas_dict)r   rl   request_typer   s       r+   _token_exchange_requestr     s    
 >>L')L
43Lv}}^d^p^pNq(rD0$sL2I2Q2QR x(v~~d3;;=>	 r-   c                V   | x| j                   dvr| j                   dk  ry | j                  j                  d      }|=	 t        |      }t        j                  |      rd|cxk  r
t        k  r|S  |t        kD  ry t        t        t         d|z  z  t"                    S # t        $ r 	 t
        j                  j                  |      }|=t        t
        j                  j                  |      t        j                         z
        nd}n# t        t        t        f$ r d}Y nw xY wY w xY w)N)i  i  i  i  zretry-afterr   r	   )status_coder>   r]   r   
ValueErroremailutilsparsedate_tz	mktime_tztimer   OSErrorr   r   r   minr   r   )responseattemptretry_afterdelayparseds        r+   _retry_delayr     s   68;O;ORU;U&&**=9"k* }}U#U(K6K(K )L,,(1g:5GHH  "[[55kBFRXRdE%++"7"7"?$))+"MNjlE%w
; E	s6   B 	D((A D	D(	D"D(!D""D('D(c                "   t        t        | dd       t              ry| j                  }t        |dd       }t        |t              rg }t        t        t           |      D ]  }t        |dd       }|t        |t        t        f      r)t        |dd       }t        |dd       }t        |dd       }t        |      r |       rt        |      rt        |      s y |       }	t        |	t              s y|j                  ||	f        || j                  t        <   yt        |d	|      }
t        |
dd       }t        |
dd       }t        |
dd       }t        |      r |       rt        |      rt        |      sy |       | j                  t        <   y)
N_contentTfieldsfileseekableseektellF_stream)r   getattrbytesstreamlistr   r   r[   callabler   appendr    _REPLAY_FILE_POSITIONS_EXTENSION_REPLAY_POSITION_EXTENSION)r@   r   r   file_positionsfieldr   r   r   r   positionsources              r+   _is_replayable_requestr   7  sl   '':t4e<^^FVXt,F&$35$v,/ 	4E5&$/D|z$e=tZ6H4.D4.DH%XZx~U]^bUcvHh,!!4"23	4 @N;<VY/Fvz40H664(D664(DHXZx~XVZ^59VG12r-   c                     t               } | t        j                  fS t        t        t
           t        | dt        j                              }t        j                  |fS )NTransportError)r   rM   r   r   r   	Exceptionr   )r   legacy_transport_errors     r+   _transport_errorsr   Y  sS    ')L%%''!$y/7<IY[a[p[p3qr!!#9::r-   c                    t        t        j                  d z  t        | dd             }|t	        d      | t        | t                     rt        |      | t        |      | )Nr@   z&X.509 token exchange connection failedr?   )	r   rM   r   r   r   r   r   r   r   )rT   r@   s     r+   _raise_transport_errorr   a  s[    6>>D('%D*IJGBCN%+-.g.E9
W
-58r-   c                  l     e Zd Zd fdZed fd       Zedd       Zed	d       Zed
d       Z xZ	S )_X509WorkloadIdentityAuthc                   t        |       t        | 	  |t               t	        t        |d      t              | _        d| _        y )N)workload_identitytoken_exchange_urlr   F)	r   superrm   r\   r   max_MAX_EXCHANGE_RETRIES_max_exchange_retries_follow_redirects)rk   r   max_retries	__class__s      r+   rm   z"_X509WorkloadIdentityAuth.__init__k  s?    ,-+<Qij%([!)<>S%T"!&r-   c                   |j                   dvrt        | 	  |      }|j                         }|j	                  d      }d|v r.t        |t              r|j                         dk7  rt        d      t        j                  |d         t        d      |S 	 |j                  r|j                         nd }t        |      r|j	                  d      nd }t        |t              rd|ind }t        ||      # t        $ r d }Y Nw xY w)	N)i  i  i  
token_typebearerz<X.509 token exchange response must use the Bearer token typeaccess_tokenzIX.509 token exchange response did not include a valid Bearer access_tokenrT   )r   body)r   r   _handle_token_responser   r]   r   r[   r6   r   _BEARER_ACCESS_TOKEN	fullmatchcontentr   r
   r   )rk   r   
token_dataresponse_bodyr   oauth_error	safe_bodyr   s          r+   r  z0_X509WorkloadIdentityAuth._handle_token_responseq  s   67AJ$MMOM&**<8J},jS6QU_UeUeUgksUs!"`aa#--j.HIQ!"mnn	!/7/?/?HMMOTM 5<M4Jm''0PT.8c.JWk*PT	(;;  	! M	!s   C7 7DDc                @    t        |      }||dk  rt        d      |S )Nr   zKX.509 token exchange response did not include a positive, finite expires_in)r   r   )rk   
expires_inexpires_in_values      r+   _validate_expires_inz._X509WorkloadIdentityAuth._validate_expires_in  s-    +J7#'71'<kllr-   c                    t        |      S rd   )r   ru   s     r+   _can_retry_requestz,_X509WorkloadIdentityAuth._can_retry_request  s    %g..r-   c                   |j                   j                  t              }t        |t              rNt        t        t        t        t        f      |      D ]&  \  }}t        |dd       }t        |      s ||       ( y |j                   j                  t              }t        |t              sy t        |j                  d|j                        }t        |dd       }t        |      r	 ||       y y )Nr   r   )r   r]   r   r   r   r   tupler   r   r   r   r   r   )rk   r@   r   r   file_positionr   r   r   s           r+   _prepare_retry_requestz0_X509WorkloadIdentityAuth._prepare_retry_request  s     ++//0PQnd+'+Dvs{1C,Dn'U (#mtVT2D>'( %%))*DE(C(GNNCvvt,D>N r-   )r   r   r   r   r}   r~   )r   r   r}   dict[str, Any])r  r   r}   r   r@   r   r}   r|   r@   r   r}   r~   )
r   r   r   rm   r   r  r  r  r  __classcell__r   s   @r+   r   r   j  sX    ' < <(     / /  r-   r   c                  b     e Zd Z	 	 	 	 	 	 	 	 d fdZ	 	 	 	 	 	 	 	 	 	 	 	 ddZedd       Z xZS )SyncX509WorkloadIdentityAuthc               6    t         |   ||       || _        y N)r   r   )r   rm   rf   rk   r   rl   r   r   s       r+   rm   z%SyncX509WorkloadIdentityAuth.__init__  s      	+<+V'r-   c                   t        | j                  ||      5 } |j                  |fd|i|cd d d        S # 1 sw Y   y xY wN)r!   r^   r   )r   rf   sendrk   r@   r!   r^   r   kwargsr   s          r+   send_api_requestz-SyncX509WorkloadIdentityAuth.send_api_request  sS     !+#9
 	H %=%%gGfGG	H 	H 	Hs	   8Ac                R   t        | j                  dz         D ]  }	 t        | j                  t	        j
                  t              d      5 }|j                  t        | j                  | j                        d d      }d d d        t        |      }|| j                  k\  s|| j                  |      c S |t        j                  |        t!        d      # 1 sw Y   ^xY w# t               $ r0}|| j                  k\  rt        |       t        d |      }Y d }~id }~ww xY wNr   T)r!   r_   )rl   F)authfollow_redirectsz6X.509 token exchange retry loop exhausted unexpectedly)ranger   r   rf   rM   rN   r\   r   r   r   r   r  r   r   r   sleepAssertionErrorrk   r   r   r   r   rT   s         r+   _fetch_token_from_exchangez7SyncX509WorkloadIdentityAuth._fetch_token_from_exchange  s   T77!;< 	"GA(%%$*JJ/G$H#' 	 #,11/0F0FTXTeTef!).  2  H	 %Xw7d888EM66x@@ 

5!-	"0 UVV-	 	 %& 4d888*51$T734s/   /C)4C C)C&	"C))D&6&D!!D&)r   r   rl   ry   r   r   r}   r~   r@   r   r!   rz   r^   r{   r   r|   r"  r   r}   r   r}   r  )r   r   r   rm   r#  r   r,  r  r  s   @r+   r  r    s    ($8(GT(cf(	(HH $	H
 !+H H H 
H  W Wr-   r  c                  j     e Zd Z	 	 	 	 	 	 	 	 d fdZ	 	 	 	 	 	 	 	 	 	 	 	 ddZedd       ZddZ xZS )	AsyncX509WorkloadIdentityAuthc               h    t         |   ||       || _        t        j                         | _        y r  )r   rm   rf   anyioLock_async_lockr  s       r+   rm   z&AsyncX509WorkloadIdentityAuth.__init__  s.     	+<+V' ::<r-   c                  K   t        | j                  ||      4 d {   } |j                  |fd|i| d {   cd d d       d {    S 7 27 7 	# 1 d {  7  sw Y   y xY wwr  )r   rf   r   r!  s          r+   r#  z.AsyncX509WorkloadIdentityAuth.send_api_request  s      (+#9
 	N 	N +++GMFMfMM	N 	N 	N
 N	N 	N 	N 	NsT   A-AA-AAA A-AA-AA-A*A!A*&A-c                h  K   | j                   4 d {    | j                  5  | j                         sD| j                         s4t	        t
        | j                        cd d d        cd d d       d {    S d d d        | j                          d {   }| j                  |       | j                  5  t	        t
        | j                        cd d d        cd d d       d {    S 7 7 y# 1 sw Y   wxY w7 f7 # 1 sw Y   nxY wd d d       d {  7   y # 1 d {  7  sw Y   y xY wwrd   )	r4  _lock_token_unusable_needs_refreshr   r[   _cached_token _fetch_token_from_exchange_async_store_token)rk   r  s     r+   get_token_asyncz-AsyncX509WorkloadIdentityAuth.get_token_async  s    ## 	5 	5 9++-d6I6I6KT%7%789 9	5 	5 	59  $DDFFJj) 5C!3!345 5	5 	5 	5 	59 9 G	55 5	5 	5 	5 	5 	5s   D2C+D2D:C/	D'D23C-4D29DC;!D6C?	DD2%C=&D2-D2/C8	4D=D2?D	DD2DD2D/#D&$D/+D2c                  K   t        | j                  dz         D ]  }	 t        | j                  t	        j
                  t              d      4 d {   }|j                  t        | j                  | j                        d d       d {   }d d d       d {    t        |      }|| j                  k\  s|| j                  |      c S |t        j                  |       d {     t!        d      7 7 s7 e# 1 d {  7  sw Y   uxY w# t               $ r0}|| j                  k\  rt        |       t        d |      }Y d }~d }~ww xY w7 lwr%  )r(  r   r   rf   rM   rN   r\   r   r   r   r   r  r   r   r2  r)  r*  r+  s         r+   r;  z>AsyncX509WorkloadIdentityAuth._fetch_token_from_exchange_async  sP    T77!;< 	)GA/%%$*JJ/G$H#' 	 	 #%2%7%7/0F0FTXTeTef!). &8 &  H	 	 %Xw7d888EM66x@@ kk%(((-	)0 UVV-	
 	 	 	 	 %& 4d888*51$T734 )s   E3DC?D7DDDDDD"2EE-E.E?DDDD	DD	DE'&EEEE)r   r   rl   r   r   r   r}   r~   r-  )r}   r[   r.  )	r   r   r   rm   r#  r   r=  r;  r  r  s   @r+   r0  r0    s    ($8(GY(hk(	(NN $	N
 !+N N N 
N  	5 	5Wr-   r0  )r)   zhttpx2.URL | strr!   zhttpx2.URL | Noner}   r~   r  )
r@   r   r!   rz   r^   r{   r_   r|   r}   r~   )
rl   ry   r!   rz   r^   r{   r_   r|   r}   ry   )
rl   r   r!   rz   r^   r{   r_   r|   r}   r   )r   r   r}   float | None)r   z.WorkloadIdentity | X509WorkloadIdentity | Noner}   zTypeIs[X509WorkloadIdentity])r   r   r}   r~   )r   r   r}   zdict[str, str])r   r   rl   z"httpx2.Client | httpx2.AsyncClientr}   r   )r   zhttpx2.Response | Noner   r   r}   r?  r  )r}   ztuple[type[Exception], ...])rT   r   r}   r   )C
__future__r   rer   r   email.utilsr   typingr   r   r   typing_extensionsr   r   r2  rM   _utilsr
   _httpx2r   r   r   	_workloadr   r   r   r   
_constantsr   r   r   _exceptionsr   r   r   r   MTLS_API_BASE_URLr\   r   r   r   r   r   compiler  r,   rA   rU   r`   BaseTransportrb   AsyncBaseTransportr   r   r   r   r   r   r   r   r   r   r   r   r   r  r0  rD   r-   r+   <module>rN     s   " 	    & & .    S S  U T V V4 E D  : #F  k !rzz"9:  Z^ aj_2oo  o '	o
 o 
o26#7#7 @F$=$= H *.    '	
  @ *. #   '	
  83C<C!Ch"" 4 	$I0D;97 56J K 7t1W#< 1Wh=W$= =Wr-   